CVE Vulnerability

CVE-2008-0757

Cross-site scripting (XSS) vulnerability in index.php in MercuryBoard 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter (aka the message text area), which leads to an injection in the messenger during private message (PM) preview. NOTE: some of these details are obtained from third party information.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://forum.aria-security.net/showthread.php?t=522
http://www.securityfocus.com/bid/27730
http://secunia.com/advisories/28899 Vendor Advisory
http://www.securitytracker.com/id?1019371
http://www.securityfocus.com/archive/1/487913/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:mercuryboard:mercuryboard_message_board:*:*:*:*:*:*:*:*
Information

Published : 2008-02-13 09:00

Updated : 2018-10-15 10:02

NVD link : CVE-2008-0757

Mitre link : CVE-2008-0757

Products Affected
No products.
CWE
CWE-116

Improper Encoding or Escaping of Output